On July 19, 2024, ESHA became aware of a data security incident affecting its server infrastructure, prompting the company to take its systems offline. Immediate efforts were made to restore the servers and safeguard the security of data stored on its systems. ESHA retained a forensic investigation firm to identify the nature of the breach and determine if personal information was impacted.
The forensic investigation revealed that unauthorized access occurred between July 13 and July 17, 2024. Certain files were identified as potentially accessed or acquired during this timeframe. ESHA conducted a thorough manual review to determine the individuals whose personal information was included in these files. This review was completed on September 16, 2024.
According to a report submitted to the U.S. Department of Health and Human Services, the breach may have impacted as many as 76,922 individuals. While there is no evidence of misuse of personal information, individuals are encouraged to take advantage of the complimentary credit monitoring service offered and remain vigilant by monitoring their financial and personal accounts. ESHA began mailing notification letters on November 15, 2024, to individuals whose information may have been compromised.
What Information Was Involved?
The investigation identified that the compromised files may have included sensitive personal information. The exact nature of the information varies by individual.
